SP 800-221 Rev. 1, Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk PortfolioInitial Public Draft
Updated 6 hours ago ()
Submit Your Feedback The public comment period is open through December 7, 2026, at 11:59 PM EST. We encourage you to use this comment template when preparing and submitting your response. About the Publication Enterprise information and communications technology risk management (ICTRM) spans and integrates a broad set of disciplines including cybersecurity, privacy, supply chain, operational technology, Internet of Things, and super intelligence. This publication promotes an integrated approach to ICT risk-aggregating and normalizing risk information across domains. Doing so allows organizations to identify, quantify, and communicate risk scenarios in financial, mission, and reputational terms comparable to non-technical enterprise risks, enabling executives to prudently allocate resources across competing risk types. Improving ICTRM in Alignment with NIST Cybersecurity Framework (CSF) 2.0 NIST SP 800-221r1 ipd helps organizations improve their ICTRM in alignment with established frameworks, including the CSF 2.0. Consistent with the CSF 2.0 Govern function, this publication emphasizes that cybersecurity governance should be central to all risk management activities, ensuring tha…
- Tags
- NIST, draft open for comment, SP 800-221 REV. 1
- Related exam domains
- CISSP 1: Security and Risk Management; CISSP 7: Security Operations; CISSP 8: Software Development Security; CISM 1: Information Security Governance; CISM 2: Information Security Risk Management; CISA 2: Governance and Management of IT; CISA 3: Information Systems Acquisition, Development and Implementation
- Source record id
- https://csrc.nist.gov/pubs/sp/800/221/r1/ipd
- First seen by InfoSec Signals
- Oct 23, 2026
Source: NIST CSRC drafts open for comment, National Institute of Standards and Technology, Computer Security Resource Center about this source more from it
Exam domain labels come from a keyword heuristic and are study hints, not an official mapping. The summary is the publisher's own text, shortened; the linked record is authoritative.